nerdexam
CompTIA

CY0-001 · Question #21

CY0-001 Question #21: Real Exam Question with Answer & Explanation

The correct answer is D. The vulnerability is sensitive information disclosure, and the analyst should employ masking.. The log data reveals personally identifiable information (PII) such as name, address, and a full credit card number. This represents a sensitive information disclosure vulnerability. The appropriate control is data masking, which protects sensitive data in logs and outputs while

Question

A security analyst is aware of an active penetration test in the environment. The analyst examines security information and event management (SIEM) log data and notices the following output from the AI system: Which of the following is the vulnerability that has occurred and the control the analyst should implement?

Exhibit

CY0-001 question #21 exhibit

Options

  • AThe vulnerability is prompt injection, and the analyst should use endpoint detection response
  • BThe vulnerability is model hallucinations, and the analyst should develop output validations.
  • CThe vulnerability is jailbreaking, and the analyst should utilize role-based access control.
  • DThe vulnerability is sensitive information disclosure, and the analyst should employ masking.
  • EThe vulnerability is role impersonation, and the analyst should use validation.

Explanation

The log data reveals personally identifiable information (PII) such as name, address, and a full credit card number. This represents a sensitive information disclosure vulnerability. The appropriate control is data masking, which protects sensitive data in logs and outputs while still allowing necessary system monitoring.

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CY0-001 Practice